feat(ops): rotate the daemon logs, and stop writing the request log to stderr

Both found on the reference deployment while updating it.

1. Nothing rotated the launchd daemon logs. Caddy rotates its own access
   logs, so those were fine; StandardOutPath/StandardErrorPath are appended
   to forever by launchd with no rotation of its own. The host had a 199 MB
   apple-docs-mcp.err.log plus ~35 MB across the proxy and cloudflared error
   logs. `install` now drops a newsyslog(8) config in /etc/newsyslog.d that
   rotates ops/logs past 10 MB and keeps 7 gzipped generations. macOS
   already runs newsyslog hourly, so this needs no new daemon. Flag `N`:
   these files are held open by launchd-managed processes with no pid file
   to signal, and the weekly autoroll restart closes the loop.

2. That 199 MB was almost entirely `info`. createLogger sent EVERY level to
   stderr, so a long-lived HTTP daemon wrote its whole request log to the
   "error" file while the .log sat empty — real failures invisible.

   The default is deliberate and stays: `apple-docs mcp start` speaks
   JSON-RPC over stdout, so a stray log line there corrupts the protocol.
   Added an opt-in split instead — APPLE_DOCS_LOG_STDOUT=1 (or
   `createLogger(level, { splitStreams: true })`) puts debug/info on stdout
   and warn/error on stderr. The web and MCP HTTP plists set it; the stdio
   server must never, and the template comments say so.

Covered by test/unit/lib/logger-streams.test.js, including that the default
keeps everything on stderr.

Suite: 2532 pass, 16 skip, 0 fail.